Your privacy matters to us. This policy explains exactly what data we collect, why we collect it, and what control you have over it. We do not sell your personal data to third parties.
01. Overview
Vivamo Inc ("Vivamo Play", "we", "us") operates the Vivamo Play platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our website, platform, or any related services.
We process personal information in accordance with applicable US federal and Texas state privacy laws. We are the data controller for personal information collected on the Platform.
02. What We Collect
| Category | Data collected | Source |
|---|---|---|
| Account data | Email address, username, password (hashed), date of birth, SSO provider ID | You, at registration |
| Profile data | Avatar, join date, completed sets, first-discovery credits | You, in-platform activity |
| Transaction data | Bundle purchases, payment method last 4 digits | You, Stripe (payment processor) |
| Platform activity | Charms discovered, Discover claims, first-discovery credits, notification interactions | Automatically, during use |
| Device & technical data | IP address (hashed for shill detection), browser type, OS, session tokens, device fingerprint (hashed) | Automatically, during use |
| Communications data | Support emails, enquiry form submissions | You, when contacting us |
| Analytics data | Page views, session duration, feature usage, charm discovery and Discover claim events | Automatically, via analytics platform |
We do not collect: full payment card numbers (handled directly by Stripe), government ID numbers, or sensitive personal data as defined under UK GDPR Article 9.
03. How We Use Your Data
To provide the platform
We process your account, profile, and platform activity data to operate the Platform, manage your collection, and process charm discovery and Discover claims. Legal basis: contract performance.
To process payments
Transaction data is shared with Stripe to process bundle purchases. We retain billing records for tax compliance. Legal basis: contract performance; legal obligation.
To prevent fraud and abuse
Hashed device fingerprints and IP addresses are used to detect multi-account abuse and automated Discover claim scripts. Raw fingerprints are never stored. Legal basis: legitimate interests.
To communicate with you
We send transactional emails (purchase receipts, email verification, discovery notifications). We send marketing emails only where you have opted in. Legal basis: contract performance; consent (marketing only).
To improve the platform
Aggregated and anonymised analytics data is used to understand feature usage, improve platform performance, and inform product decisions. Legal basis: legitimate interests.
04. Sharing Your Data
We do not sell your personal data. We share data only in the following circumstances:
- Stripe— payment processing. Stripe's privacy policy governs their handling of payment data.
- Firebase / FCM — push notification delivery (post-launch).
- Analytics platform — aggregated, pseudonymised usage data (Mixpanel, Amplitude, or PostHog — to be confirmed at launch).
- Partner game studios— where you play through a partner studio's game, your username and public profile (including first-discovery credits) may be visible to that studio for engagement and retention reporting. No financial data is shared with studios.
- Legal requirements — we may disclose data where required by law, court order, or regulatory authority.
- Business transfer — in the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to equivalent privacy protections.
All third-party processors are subject to data processing agreements requiring GDPR-compliant handling of your data.
05. Cookies & Tracking
We use cookies and similar technologies for:
- Essential cookies — session authentication, CSRF tokens. These cannot be disabled without breaking the Platform.
- Preference cookies — remembering your login and notification preferences.
- Analytics cookies — pseudonymised usage tracking to understand how the Platform is used. You may opt out via the cookie banner.
We do not use third-party advertising or tracking cookies. Our cookie banner allows granular control. We default to the most privacy-preserving option.
06. Data Retention
- Active accounts: retained while your account is active.
- Deleted accounts: 30-day soft-delete period, then permanent deletion within 60 days (except where retained for legal compliance).
- Transaction records: 7 years for tax and legal compliance.
- Hashed device fingerprints: 90 days from last use.
- Support communications: 2 years from last interaction.
- Analytics data: 24 months rolling, then aggregated.
07. Your Rights
Depending on your state of residence, you may have the following rights regarding your personal information:
To exercise any of these rights, contact privacy@vivamoplay.com or call (346) 271-7446. We will respond within 45 days (extendable by a further 45 days where reasonably necessary). You may also have the right to lodge a complaint with the Federal Trade Commission (FTC) at ftc.gov or with your state Attorney General's office.
08. Children's Privacy
The Platform is not directed to children under 13. Players aged 13–17 require parental consent to register. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, contact privacy@vivamoplay.com immediately and we will delete it.
09. Security
We implement industry-standard security measures including TLS encryption in transit, bcrypt password hashing, JWT with refresh token rotation, HSTS enforcement, and CSRF protection on all state-changing endpoints. Sensitive payment data is handled exclusively by Stripe and never touches our servers.
No system is perfectly secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users without undue delay and comply with applicable US state breach notification laws.
10. International Transfers
Vivamo Inc is based in the United States and processes all data within the US. If you access the Platform from outside the US, your personal information will be transferred to and processed in the United States. By using the Platform, you consent to this transfer. We take appropriate technical and contractual measures to protect your information regardless of where it is processed.
11. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated by email or in-app notification at least 14 days before they take effect. The "Last updated" date at the top of this page will always reflect the most recent revision.
12. Contact & Privacy Enquiries
For all privacy-related enquiries, Subject Access Requests, or to exercise your rights:
Vivamo Inc
708 Main St, 10th Floor
Houston, TX 77002
United States
Phone: (346) 271-7446 (Mon–Fri, 9 am–5 pm CT)
Privacy enquiries: privacy@vivamoplay.com
General support: support@vivamoplay.com
Response time: we aim to acknowledge requests within 5 business days and respond in full within 30 days.
Discover it first. Play Your Way. — This Privacy Policy reflects Vivamo Play's charm discovery mechanics.